Tweet
ARMENIA JAILS BREDOLAB BOTMASTER FOR 4 YEARS
By John Leyden
Register
http://www.theregister.co.uk/2012/05/23/bredolab_botmaster_jailed/
May 23 2012
First computer crime conviction in the former Soviet republic
A cybercrook who established a 30 million computer strong botnet has
been jailed for four years in Armenia.
Georgy Avanesov, 27, a Russian citizen of Armenian descent, had
apparently been making a cool $125,000 a month renting out access to
zombie drones in the infamous Bredolab botnet.
Other crooks used access to these compromised Windows PCs to either
distribute spam, launch DDoS attacks or to mount scareware (fake
anti-virus) scams. DDoS targets reportedly included Russian anti-virus
firm Kaspersky Lab.
Bredolab, which disgorged more than 3 billion malicious emails a
day at its peak, spread by planting malicious scripts on legitimate
websites. These scripts used browsers exploits and the like to drop
the zombie software onto the Windows PCs.
Components of the Bredolab malware were designed to steal usernames
and passwords to FTP accounts, creating a means to plant malicious
code onto more legitimate sites in the process, further multiplying
the spread of infection.
Prospective marks were tricked into visiting compromised sites using
spam emails with dodgy HTML attachments that posed as messages from the
likes of Facebook, Skype and Amazon. Screenshots of infected email,
along with commentary on the botnet and Avanesov's prosecution,
can be found in a blog post by Sophos here.
"It's easy to see how such a large network of infected PCs was created,
as people clicked on seemingly legitimate attachments and websites,
oblivious to the infection that would go on to take control of their
PC, and in some cases steal passwords and usernames," commented Graham
Cluley, a senior technology consultant at Sophos. "To prevent botnets
such as this forming, it is critical that website administrators
don't let FTP software remember passwords, and that users are more
cautious in the attachments they download."
Avanesov's downfall followed swiftly on the heels of the botnet
takedown operation in October 2010.
Dutch police seized control of command & control servers associated
with the Bredolab botnet, using this access to display warning messages
to users with compromised PCs. Days afterwards, Avanesov was arrested
at Yerevan's Zvartnots Airport in Armenia, shortly after he stepped
off a late night flight from Moscow.
The 27-year-old is the first person in Armenia to be jailed for
violation of Armenia's computer crime laws. Local (English language)
reports on Avanesov's sentencing on Tuesday can be found here. ®
By John Leyden
Register
http://www.theregister.co.uk/2012/05/23/bredolab_botmaster_jailed/
May 23 2012
First computer crime conviction in the former Soviet republic
A cybercrook who established a 30 million computer strong botnet has
been jailed for four years in Armenia.
Georgy Avanesov, 27, a Russian citizen of Armenian descent, had
apparently been making a cool $125,000 a month renting out access to
zombie drones in the infamous Bredolab botnet.
Other crooks used access to these compromised Windows PCs to either
distribute spam, launch DDoS attacks or to mount scareware (fake
anti-virus) scams. DDoS targets reportedly included Russian anti-virus
firm Kaspersky Lab.
Bredolab, which disgorged more than 3 billion malicious emails a
day at its peak, spread by planting malicious scripts on legitimate
websites. These scripts used browsers exploits and the like to drop
the zombie software onto the Windows PCs.
Components of the Bredolab malware were designed to steal usernames
and passwords to FTP accounts, creating a means to plant malicious
code onto more legitimate sites in the process, further multiplying
the spread of infection.
Prospective marks were tricked into visiting compromised sites using
spam emails with dodgy HTML attachments that posed as messages from the
likes of Facebook, Skype and Amazon. Screenshots of infected email,
along with commentary on the botnet and Avanesov's prosecution,
can be found in a blog post by Sophos here.
"It's easy to see how such a large network of infected PCs was created,
as people clicked on seemingly legitimate attachments and websites,
oblivious to the infection that would go on to take control of their
PC, and in some cases steal passwords and usernames," commented Graham
Cluley, a senior technology consultant at Sophos. "To prevent botnets
such as this forming, it is critical that website administrators
don't let FTP software remember passwords, and that users are more
cautious in the attachments they download."
Avanesov's downfall followed swiftly on the heels of the botnet
takedown operation in October 2010.
Dutch police seized control of command & control servers associated
with the Bredolab botnet, using this access to display warning messages
to users with compromised PCs. Days afterwards, Avanesov was arrested
at Yerevan's Zvartnots Airport in Armenia, shortly after he stepped
off a late night flight from Moscow.
The 27-year-old is the first person in Armenia to be jailed for
violation of Armenia's computer crime laws. Local (English language)
reports on Avanesov's sentencing on Tuesday can be found here. ®